Skip to content

Commit 68fd949

Browse files
GeekMasherGeekMasher
authored
Go: Fix GoLang queries (#43)
* fix(go): Fix Go CMDi query * feat(go): Update SqlInjection Query * fix(go): Update UntrustedFlowSource
1 parent d7ea57c commit 68fd949

File tree

8 files changed

+61
-46
lines changed

8 files changed

+61
-46
lines changed

‎go/lib/codeql-pack.lock.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.2.7
66
codeql/go-all:
7-
version: 0.6.4
7+
version: 0.8.1
88
codeql/mad:
9-
version: 0.1.4
9+
version: 0.2.16
1010
codeql/ssa:
11-
version: 0.1.4
11+
version: 0.2.16
1212
codeql/tutorial:
13-
version: 0.1.4
13+
version: 0.2.16
14+
codeql/typetracking:
15+
version: 0.2.16
1416
codeql/util:
15-
version: 0.1.4
17+
version: 0.2.16
1618
compiled: false

‎go/src/audit/CWE-089/SqlInjectionAudit.ql

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,30 @@
1212
*/
1313

1414
import go
15-
import semmle.go.security.SqlInjection
16-
import DataFlow::PathGraph
1715
import ghsl.Utils
16+
private import semmle.go.security.SqlInjectionCustomizations
1817

1918
/**
2019
* A taint-tracking configuration for detecting SQL injection vulnerabilities.
2120
*/
22-
class SqlInjectionAudit extends TaintTracking::Configuration {
23-
SqlInjectionAudit() { this = "SqlInjectionAudit" }
21+
private module Config implements DataFlow::ConfigSig {
22+
predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
2423

25-
override predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
24+
predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
2625

27-
override predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
26+
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
27+
NoSql::isAdditionalMongoTaintStep(pred, succ)
28+
}
2829

29-
override predicate isSanitizer(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
30+
predicate isBarrier(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
3031
}
3132

32-
from SqlInjectionAudit config, DataFlow::PathNode source, DataFlow::PathNode sink
33-
where config.hasFlowPath(source, sink)
34-
select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
35-
"a user-provided value"
33+
/** Tracks taint flow for reasoning about SQL-injection vulnerabilities. */
34+
module Flow = TaintTracking::Global<Config>;
35+
36+
import Flow::PathGraph
37+
38+
from Flow::PathNode source, Flow::PathNode sink
39+
where Flow::flowPath(source, sink)
40+
select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
41+
"user-provided value"

‎go/src/audit/explore/RemoteFlowSources.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
import semmle.go.security.FlowSources
1010

11-
from UntrustedFlowSource source
11+
from RemoteFlowSource::Range source
1212
where not source.getFile().getRelativePath().matches("%/test/%")
1313
select source, "remote", source.getFile().getRelativePath(), source.getStartLine(),
1414
source.getEndLine(), source.getStartColumn(), source.getEndColumn()

‎go/src/codeql-pack.lock.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.2.7
66
codeql/go-all:
7-
version: 0.6.4
7+
version: 0.8.1
88
codeql/mad:
9-
version: 0.1.4
9+
version: 0.2.16
1010
codeql/ssa:
11-
version: 0.1.4
11+
version: 0.2.16
1212
codeql/tutorial:
13-
version: 0.1.4
13+
version: 0.2.16
14+
codeql/typetracking:
15+
version: 0.2.16
1416
codeql/util:
15-
version: 0.1.4
17+
version: 0.2.16
1618
compiled: false

‎go/src/security/CWE-078/CommandInjection.ql

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,12 @@ import go
1515
import semmle.go.security.CommandInjection
1616
import semmle.go.security.FlowSources
1717

18+
/**
19+
* Flow configuration for command injection
20+
*/
1821
module FlowConfig implements DataFlow::ConfigSig {
1922
predicate isSource(DataFlow::Node node) {
20-
exists(UntrustedFlowSource source, Function function, DataFlow::CallNode callNode |
23+
exists(RemoteFlowSource::Range source, Function function, DataFlow::CallNode callNode |
2124
source.asExpr() = node.asExpr() and
2225
source.(DataFlow::ExprNode).asExpr().getEnclosingFunction() = function.getFuncDecl() and
2326
(
@@ -33,11 +36,21 @@ module FlowConfig implements DataFlow::ConfigSig {
3336
predicate isSink(DataFlow::Node sink) {
3437
exists(CommandInjection::Sink s | sink = s | not s.doubleDashIsSanitizing())
3538
}
39+
40+
predicate isBarrier(DataFlow::Node node) { node instanceof CommandInjection::Sanitizer }
3641
}
3742

3843
module Flow = TaintTracking::Global<FlowConfig>;
3944

40-
from Flow::PathNode source, Flow::PathNode sink
41-
where Flow::flowPath(source, sink)
45+
module FlowGraph =
46+
DataFlow::MergePathGraph<Flow::PathNode, CommandInjection::DoubleDashSanitizingFlow::PathNode,
47+
Flow::PathGraph, CommandInjection::DoubleDashSanitizingFlow::PathGraph>;
48+
49+
import FlowGraph::PathGraph
50+
51+
from FlowGraph::PathNode source, FlowGraph::PathNode sink
52+
where
53+
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
54+
CommandInjection::DoubleDashSanitizingFlow::flowPath(source.asPathNode2(), sink.asPathNode2())
4255
select sink.getNode(), source, sink, "This command depends on a $@.", source.getNode(),
4356
"user-provided value"

‎go/test/codeql-pack.lock.yml

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,17 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.2.7
66
codeql/go-all:
7-
version: 0.6.4
8-
codeql/go-queries:
9-
version: 0.6.4
7+
version: 0.8.1
108
codeql/mad:
11-
version: 0.1.4
9+
version: 0.2.16
1210
codeql/ssa:
13-
version: 0.1.4
14-
codeql/suite-helpers:
15-
version: 0.6.4
11+
version: 0.2.16
1612
codeql/tutorial:
17-
version: 0.1.4
13+
version: 0.2.16
14+
codeql/typetracking:
15+
version: 0.2.16
1816
codeql/util:
19-
version: 0.1.4
17+
version: 0.2.16
2018
compiled: false

‎go/test/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: githubsecurtylab/codeql-go-tests
22
groups: [go, test]
33
dependencies:
44
codeql/go-all: '*'
5-
codeql/go-queries: '*'
5+
# codeql/go-queries: '*'
66
githubsecuritylab/codeql-go-queries: '*'
77
githubsecuritylab/codeql-go-libs: '*'
88
extractor: go

‎go/test/security/CWE-078/cmdi.expected

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,10 @@
11
edges
2-
| main.go:11:13:11:19 | selection of URL | main.go:11:13:11:27 | call to Query |
3-
| main.go:11:13:11:27 | call to Query | main.go:12:22:12:28 | cmdName |
4-
| main.go:20:14:20:20 | selection of URL | main.go:20:14:20:28 | call to Query |
5-
| main.go:20:14:20:28 | call to Query | main.go:27:22:27:28 | cmdName |
2+
| main.go:20:14:20:20 | selection of URL | main.go:20:14:20:28 | call to Query | provenance | MaD:732 |
3+
| main.go:20:14:20:28 | call to Query | main.go:27:22:27:28 | cmdName | provenance | |
64
nodes
7-
| main.go:11:13:11:19 | selection of URL | semmle.label | selection of URL |
8-
| main.go:11:13:11:27 | call to Query | semmle.label | call to Query |
9-
| main.go:12:22:12:28 | cmdName | semmle.label | cmdName |
105
| main.go:20:14:20:20 | selection of URL | semmle.label | selection of URL |
116
| main.go:20:14:20:28 | call to Query | semmle.label | call to Query |
127
| main.go:27:22:27:28 | cmdName | semmle.label | cmdName |
138
subpaths
149
#select
15-
| main.go:12:22:12:28 | cmdName | main.go:11:13:11:19 | selection of URL | main.go:12:22:12:28 | cmdName | This command depends on a $@. | main.go:11:13:11:19 | selection of URL | user-provided value |
1610
| main.go:27:22:27:28 | cmdName | main.go:20:14:20:20 | selection of URL | main.go:27:22:27:28 | cmdName | This command depends on a $@. | main.go:20:14:20:20 | selection of URL | user-provided value |

0 commit comments

Comments
 (0)